732 matches found
Calibre 授权问题漏洞
Calibre is an open source, free, all-in-one eBook reading management and format conversion tool from Kovid Goyal, an individual developer in India. An authorization issue vulnerability exists in Calibre, which stems from the product's devices/linuxmounthelper.c file not validating user privileges...
Calibre 代码问题漏洞
Calibre is an open source free all-in-one eBook reading management and format conversion tool by Kovid Goyal, an individual developer in India. Calibre suffers from a code issue vulnerability that stems from an untrusted search path issue found in devices linux mount helper.c. The vulnerability c...
RM: calibre/buster-backports -- ROM; no security support; bpo10s of a newer version are impossible
Dear Backports admins, I am requesting the removal of calibre from buster-backports, because it has no security support and because newer versions of Calibre depend on a newer Qt version that cannot be backported. I delayed this request until Bullseye was released, so that users would have a...
RM: calibre/buster-backports -- ROM; no security support; bpo10s of a newer version are impossible
Dear Backports admins, I am requesting the removal of calibre from buster-backports, because it has no security support and because newer versions of Calibre depend on a newer Qt version that cannot be backported. I delayed this request until Bullseye was released, so that users would have a...
Calibre-Web Cross-Site Scripting Vulnerability
Calibre-Web is a web application for browsing, reading and downloading eBooks from the Calibre database. A cross-site scripting vulnerability exists in the Calibre-web application versions v0.6.0 through v0.6.12, which can be exploited by an attacker to inject JavaScript exploit script into the...
CVE-2021-25964
In “Calibre-web” application, v0.6.0 to v0.6.12, are vulnerable to Stored XSS in “Metadata”. An attacker that has access to edit the metadata information, can inject JavaScript payload in the description field. When a victim tries to open the file, XSS will be triggered...
CVE-2021-25964
In “Calibre-web” application, v0.6.0 to v0.6.12, are vulnerable to Stored XSS in “Metadata”. An attacker that has access to edit the metadata information, can inject JavaScript payload in the description field. When a victim tries to open the file, XSS will be triggered...
Design/Logic Flaw
In “Calibre-web” application, v0.6.0 to v0.6.12, are vulnerable to Stored XSS in “Metadata”. An attacker that has access to edit the metadata information, can inject JavaScript payload in the description field. When a victim tries to open the file, XSS will be triggered...
CVE-2021-25964 Stored Cross-Site Scripting (XSS) in Calibre-web via Description Field in Metadata
In “Calibre-web” application, v0.6.0 to v0.6.12, are vulnerable to Stored XSS in “Metadata”. An attacker that has access to edit the metadata information, can inject JavaScript payload in the description field. When a victim tries to open the file, XSS will be triggered...
CVE-2021-25964
CVE-2021-25964 affects Calibre-web versions 0.6.0–0.6.12. A stored XSS vulnerability exists in the Metadata description field; an attacker with permission to edit metadata can inject JavaScript, which is triggered when a victim opens the file. This is the documented impact in multiple connected s...
CVE-2021-25964 Stored Cross-Site Scripting (XSS) in Calibre-web via Description Field in Metadata
In “Calibre-web” application, v0.6.0 to v0.6.12, are vulnerable to Stored XSS in “Metadata”. An attacker that has access to edit the metadata information, can inject JavaScript payload in the description field. When a victim tries to open the file, XSS will be triggered...
PT-2021-16888 · Unknown · Calibre-Web
Name of the Vulnerable Software and Affected Versions: Calibre-web versions 0.6.0 through 0.6.12 Description: The issue concerns a Stored XSS in the "Metadata" of the Calibre-web application. An attacker with access to edit metadata information can inject a JavaScript payload in the description...
Calibre-Web 跨站脚本漏洞
Calibre-Web is a web application for browsing, reading and downloading eBooks from the Calibre database. A cross-site scripting vulnerability exists in the Calibre-web application versions v0.6.0 through v0.6.12, which can be exploited by an attacker to inject JavaScript exploit script into the...
Cross-Site Request Forgery (CSRF) in janeczku/calibre-web
Description csrf bug to chnage shelf from private to public Proof of Concept Bellow request is vulnerable to csrf attack document.getElementById"test".click; Impact csrf bug to change anyone shelf status from private to public...
Cross-Site Request Forgery (CSRF) in janeczku/calibre-web
Description Hi team :, the /shelf/remove/id and /shelf/add/id is vulnerable against CSRFleading to the possibility to add and remove shelves' items on the behalf of the victim user. Proof of Concept 1. Install the application 2. Create a new shelf id == 1 in this case 3. The attacker sends the...
Cross-site Scripting (XSS) - Stored in janeczku/calibre-web
💥 BUG stored xss via book description 💥 STEP TO REPRODUCE Lets there is two user Admin and user-B . user-B has edit permission in book.\ \ 1. Now goto user-B account and visit http://localhost:8083/admin/book/12 and edit the metadata .\ During edit put bellow xss payload in book Description field...
Cross-Site Request Forgery (CSRF) in janeczku/calibre-web
✍️ Description An attacker can make a user change his profile settings by CSRF vulnerability through PoC file. There is no CSRF token. 🕵️♂️ Proof of Concept For example, changing the email address from "[email protected]" to "[email protected]" test1's profile. Make the user open a link with this page...
Calibre-Web Authorization Issues Vulnerability
Calibre-Web is a web application for browsing, reading and downloading eBooks from the Calibre database. An authorization issue vulnerability exists in Calibre-Web version 0.6.6, which stems from the program's use of a hard-coded secret key that can be exploited by an attacker to bypass...